summaryrefslogtreecommitdiffstats
path: root/sys/netinet6 (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Accept inet6 address with missing sa_len for the get ioctl(2).bluhm2019-11-181-1/+2
| | | | | dhcpcd from ports uses SIOCGIFAFLAG_IN6 without setting sin6_len. OK deraadt@ millert@
* Kernel is missing propper input validation when configuring IPv6bluhm2019-11-112-40/+48
| | | | | | | | addresses. Implement in6_sa2sin6() to validate inet6 address family and address length. The SIOCGIFDSTADDR_IN6, SIOCGIFNETMASK_IN6, SIOCGIFAFLAG_IN6, SIOCGIFALIFETIME_IN6, and SIOCDIFADDR_IN6 ioctl(2) are safe now. OK visa@
* convert interface address change hooks to tasks and a task_list.dlg2019-11-082-9/+9
| | | | | | | | | | | | | | | this follows what's been done for detach and link state hooks, and makes handling of hooks generally more robust. address hooks are a bit different to detach/link state hooks in that there's only a few things that register hooks (carp, pf, vxlan), but a lot of places to run the hooks (lots of ipv4 and ipv6 address configuration). an address hook cookie was in struct pfi_kif, which is part of the pf abi. rather than break pfctl -sI, this maintains the void * used for the cookie and uses it to store a task, which is then used as intended with the new api.
* Avoid NULL dereference in arpinvalidate() and nd6_invalidate() bykrw2019-11-071-1/+3
| | | | | | making RTM_INVALIDATE code path perform same check as RTM_DELETE does. ok mpi@
* Fix white spaces and use __func__ in printf().bluhm2019-10-221-26/+26
|
* Don't check that the ipv6 source address of a neighbor advertisment isbenno2019-10-181-10/+1
| | | | | | | | | | | | | | from a neighbor's address. Sthen@ dug out RFC 4861 4.4 that says that the source address is "An address assigned to the interface from which the advertisement is sent." -- which can be from a network that the receiver does not know about. Indeed my provider sends such a neighbor advertisment for my default gateway, which breaks my uplink. Claudio@ added this check for symetry with NetBSD code when he added the same check to nd6_ns_input(), where it is needed to fix CVE-2008-2476. See also OpenBSD 4.2 errata 15. ok claudio@, kn@
* in6_setsockaddr and in6_setpeeraddr can't fail, so let them return void.dlg2019-10-171-7/+3
| | | | | | this also brings them in line with the AF_INET equivalents. ok visa@ bluhm@
* Add RCS Id.bluhm2019-09-041-0/+1
|
* Fix a route use after free in IPv6 multicast route. Move thebluhm2019-09-041-35/+36
| | | | | | | | | | | | | mrt6_mcast6_del() out of the rtable_walk(). This avoids recursion to prevent stack overflow. Also it allows freeing the route outside of the walk. Now mrt6_mcast_del() frees the route only when it is deleted from the routing table. If that fails, it must not be freed. After the route is returned by mf6c_find(), it is reference counted. Then we need a rtfree(), but not in the other case. Name mrt6_mcast_add() and mrt6_mcast_del() consistently. Move rt_timer_remove_all() into mrt6_mcast_del(). Reported-by: syzbot+af7d510593d74c825960@syzkaller.appspotmail.com OK mpi@
* Do not use the flow of the first fragment to store ECN information.bluhm2019-08-262-7/+8
| | | | | | Handle the ECN in the fragment queue. Reported-by: syzbot+0aa80b25e9041001cac8@syzkaller.appspotmail.com fix from FreeBSD; OK claudio@
* Remove support for semantically opace interface identifiers (RFC 7217)florian2019-08-213-97/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | for IPv6 link local addresses. Some hosting and VM providers route customer IPv6 prefixes to link local addresses derived from ethernet MAC addresses (RFC 2464). This leads to hard to debug IPv6 connectivity problems and is probably not worth the effort. RFC 7721 lists 4 weaknesses: 3.1. Correlation of Activities over Time & 3.2. Location Tracking These are still possible with RFC 7217 addresses for an adversary connected to the same layer 2 network (think conference wifi). Since the link local prefix stays the same (fe80::/64) the link local addresses do not change between different networks. An adversary on the same layer 2 network can probably track ethernet MAC addresses via different means, too. 3.3. Address Scanning & 3.4. Device-Specific Vulnerability Exploitation These now become possible, however, as noted above a layer 2 adversary was probably able to do this via different means. People concerned with these weaknesses are advised to use ifconfig lladdr random. OK benno input & OK kn
* When we needed the kernel lock for local IP packet delivery, mpi@bluhm2019-08-061-44/+3
| | | | | | | | | | | introduced a queue to grab the lock for multiple packets. Now we have only netlock for both IP and protocol input. So the queue is not necessary anymore. It just switches CPU and decreases performance. So remove the inet and inet6 ip queue for local packets. To get TCP running on loopback, we have to queue once between TCP input and output of the two sockets. So use the loopback queue in looutput() unconditionally. OK visa@
* Prevent recursions by not deleting entries inside rtable_walk(9).mpi2019-06-213-25/+36
| | | | | | | | | | | | | | | rtable_walk(9) now passes a routing entry back to the caller when a non zero value is returned and if it asked for it. This allows us to call rtdeletemsg()/rtrequest_delete() from the caller without creating a recursion because of rtflushclone(). Multicast code hasn't been adapted and is still possibly creating recursions. However multicast route entries aren't cloned so if a recursion exists it isn't because of rtflushclone(). Fix stack exhaustion triggered by the use of "-msave-args". Issue reported by Dániel Lévai on bugs@ confirmed by and ok bluhm@.
* In arp_rtrequest and nd6_rtrequest return early if the RTF_MPLS flag isclaudio2019-06-131-2/+2
| | | | | | | | set. These mpls routes use the rt_llinfo structure to store the MPLS label and would confuse the arp and nd6 code. OK bluhm@ anton@ Reported-by: syzbot+927e93a362f3ae33dd9c@syzkaller.appspotmail.com
* Copy the user provided sockaddr into a normalized sockaddr in rtrequest()claudio2019-06-131-1/+2
| | | | | | | | | | before adding it to the routing table. The rtable code is doing memcmp() of those rt_dest sockaddrs so it is important that they are stored in a canonical form. To do this struct domain is extended to include the sockaddr size for this address family. OK bluhm@ anton@ Reported-by: syzbot+10fe9cd8d0211c562ead@syzkaller.appspotmail.com
* use m_microtime instead of microtime for SO_TIMESTAMP socketopt handlingdlg2019-06-101-2/+2
| | | | | | drivers can set ph_timestamp when packets are received by the hardware, which should be more accurate and cheaper than getting the clock when the packet is queued on the socket.
* Use mallocarray(9) & put some free(9) sizes for M_IPMOPTS allocations.mpi2019-06-101-6/+4
| | | | ok semarie@, visa@
* Add missing NULL check for the protocol control block (pcb) pointer inanton2019-06-041-0/+3
| | | | | | | | | | mrt{6,}_ioctl. Calling shutdown(2) on the socket prior to the ioctl command can cause it to be NULL. ok bluhm@ claudio@ Reported-by: syzbot+bdc489ecb509995a21ed@syzkaller.appspotmail.com Reported-by: syzbot+156405fdea9f2ab15d40@syzkaller.appspotmail.com
* Removes the KERNEL_LOCK() from bridge(4)'s output fast-path.mpi2019-04-281-3/+3
| | | | | | | | This redefines the ifp <-> bridge relationship. No lock can be currently used across the multiples contexts where the bridge has tentacles to protect a pointer, use an interface index. Tested by various, ok dlg@, visa@
* For raw IPv6 sockets userland may specify an offset where thebluhm2019-04-232-6/+19
| | | | | | | | checksum field is located. During rip6 input and output make sure that this field is within the packet. The offset my be -1 to disable the feature, otherwise it must be non-negative and aligned. Do a stricter check during setsockopt(2). from FreeBSD; OK claudio@
* In in_cksum() and in6_cksum() convert types to C99 style and makebluhm2019-04-222-29/+35
| | | | | | | both functions consistent. In in_cksum() panic if len is longer than mbuf, but in in6_cksum() do not panic if off and len match exactly to the end of mbuf. OK claudio@
* Statistics of "netstat -s -f inet6 -p rip6" did not work. Inbluhm2019-04-201-2/+2
| | | | | rip6_sysctl_rip6stat() copy out rip6counters, not ip6counters. OK deraadt@ claudio@
* change rt_ifa_add and rt_ifa_del so they take an rdomain argument.dlg2019-02-133-9/+14
| | | | | | | | | | | | this allows mpls interfaces (mpe, mpw) to pass the rdomain they wish the local label to be in, rather than have it implicitly forced to 0 by these functions. right now they'll pass 0, but it will soon be possible to have them rx packets in other rdomains. previously the functions used ifp->if_rdomain for the rdomain. everything other than mpls still passes ifp->if_rdomain. ok mpi@
* remove the implict RTF_MPATH flag that rt_ifa_add() sets on new routes.dlg2019-02-103-6/+8
| | | | | | | | | | | | | | | | | | | | | | | | | MPLS interfaces (ab)use rt_ifa_add for adding the local MPLS label that they listen on for incoming packets, while every other use of rt_ifa_add is for adding addresses on local interfaces. MPLS does this cos the addresses involved are in basically the same shape as ones used for setting up local addresses. It is appropriate for interfaces to want RTF_MPATH on local addresses, but in the MPLS case it means you can have multiple local things listening on the same label, which doesn't actually work. mpe in particular keeps track of in use labels to it can handle collisions, however, mpw does not. It is currently possible to have multiple mpw interfaces on the same local label, and sharing the same label as mpe or possible normal forwarding labels. Moving the RTF_MPATH flag out of rt_ifa_add means all the callers that still want it need to pass it themselves. The mpe and mpw callers are left alone without the flag, and will now get EEXIST from rt_ifa_add when a label is already in use. ok (and a huge amount of patience and help) mpi@ claudio@ is ok with the idea, but saw a much much earlier solution to the problem
* Avoid an mbuf double free in the oob soreceive() path. In thebluhm2019-02-042-16/+16
| | | | | | | | | | usrreq functions move the mbuf m_freem() logic to the release block instead of distributing it over the switch statement. Then the goto release in the initial check, whether the pcb still exists, will not free the mbuf for the PRU_RCVD, PRU_RVCOOB, PRU_SENSE command. OK claudio@ mpi@ visa@ Reported-by: syzbot+8e7997d4036ae523c79c@syzkaller.appspotmail.com
* rework icmp6_error() to be closer to icmp_error()denis2018-12-251-39/+56
| | | | input & OK mpi@
* The timeouts in nd6 are in msec so just use timeout_add_msec() insteadclaudio2018-12-201-7/+5
| | | | | of some complicated match to convert them to ticks. OK visa@ bluhm@ kn@
* When forwarding IPv6 packets, generated ICMP6 packets used thebluhm2018-12-101-2/+8
| | | | | | | | interface address of the route as source address. To avoid using link-local addresses in ICMP6 packets sent into networks where they are out of scope, use the regular IPv6 source selection algorithm also in this icmp6_reflect() case. reported by sthen@; fix from Arnaud BRAND; OK claudio@
* We are not going to send a neighbor advertisement from a non-masterflorian2018-12-071-7/+7
| | | | | | carp interface. Move the check to the beginning of the function to make it clear that there are no other side effects happening. OK claudio
* When building ND packets use m_align() to pack the mbuf as optimal asclaudio2018-12-061-5/+4
| | | | | | possible. Because of an optional payload maxlen bytes are used on the m_align so that there is always enough space. OK florian@
* Convert more MH_ALIGN() to m_align(). Also switch from m_gethdr/M_GETHDRclaudio2018-12-031-3/+3
| | | | | | calls to m_get/M_GET calls because M_MOVE_PKTHDR() is initialising the pkthdr and so it is not needed when allocation the header. OK bluhm@
* MH_ALIGN -> m_alignclaudio2018-11-301-2/+2
| | | | OK bluhm@
* Retire dom_rtkeylen from struct domain. Nothing is using this anymore.claudio2018-11-191-2/+1
| | | | | It was used by the original patricia tree. OK mpi@
* M_LEADINGSPACE() and M_TRAILINGSPACE() are just wrappers forclaudio2018-11-093-7/+7
| | | | | | m_leadingspace() and m_trailingspace(). Convert all callers to call directly the functions and remove the defines. OK krw@, mpi@
* Remove the last few XXX rdomain markers. Even those functions respect theclaudio2018-11-091-2/+1
| | | | | rdomain now and are therefor rdomain save. OK mpi@
* RT_TABLEID_MAX is 255, fix places that assumed that it is less than 255.reyk2018-10-102-5/+5
| | | | | | | | | | rtable 255 is a valid routing table or domain id that wasn't handled by the ip[6]_mroute code or by snmpd. The arrays in the ip[6]_mroute code where off by one and didn't allocate space for rtable 255; snmpd simply ignored rtable 255. All other places in the tree seem to handle RT_TABLEID_MAX correctly. OK florian@ benno@ henning@ deraadt@
* Do not join node information multicast group (RFC 4620).florian2018-10-053-68/+3
| | | | | | | | Benno removed code to answer ICMP queries over 4 years ago. Aham Brahmasmi (aham.brahmasmi AT gmx.com) points out that we still joined the group though. OK sthen, bluhm, kn
* Revert the inpcb table mutex commit. It triggers a witness panicbluhm2018-10-043-26/+4
| | | | | | | in raw IP delivery and UDP broadcast loops. There inpcbtable_mtx is held and sorwakeup() is called within the loop. As sowakeup() grabs the kernel lock, we have a lock ordering problem. found by Hrvoje Popovski; OK deraadt@ mpi@
* As a step towards per inpcb or socket locks, remove the net lockbluhm2018-09-203-5/+27
| | | | | | | | | | | | for netstat -a. Introduce a global mutex that protects the tables and hashes for the internet PCBs. To detect detached PCB, set its inp_socket field to NULL. This has to be protected by a per PCB mutex. The protocol pointer has to be protected by the mutex as netstat uses it. Always take the kernel lock in in_pcbnotifyall() and in6_pcbnotify() before the table mutex to avoid lock ordering problems in the notify functions. OK visa@
* Add reference counting for inet pcb, this will be needed when webluhm2018-09-132-4/+7
| | | | | | start locking the socket. An inp can be referenced by the PCB queue and hashes, by a pf mbuf header, or by a pf state key. OK visa@
* Convert inetctlerrmap to u_char like inet6ctlerrmap. That is alsobluhm2018-09-112-28/+4
| | | | | what FreeBSD does. Remove old #if 0 version of inet6ctlerrmap. OK mpi@
* Make the distribution of in_ and in6_ functions in in_pcb.c andbluhm2018-09-111-47/+182
| | | | | | | | | in6_pcb.c consistent, to ease comparing the code. Move all inet6 functions to in6_. Bring functions in both source files in same order. Cleanup the include section. Now in_pcb.c is a superset of in6_pcb.c. The latter contains all the special implementations. Just moving arround, no code change intended. OK mpi@
* Instead of calculating the mbuf packet header length here and there,bluhm2018-09-101-9/+2
| | | | | | put the algorithm into a new function m_calchdrlen(). Also set an uninitialized m_len to 0 in NFS code. OK claudio@
* During fragment reassembly, mbuf chains with packet headers werebluhm2018-09-101-2/+5
| | | | | | | created. Add a new function m_removehdr() do convert packet header mbufs within the chain to regular mbufs. Assert that the mbuf at the beginning of the chain has a packet header. found by Maxime Villard in NetBSD; from markus@; OK claudio@
* factor error code in icmp6_mtudisc_clone(); ok kn@ florian@miko2018-09-051-17/+12
|
* Add per-TDB counters and a new SADB extension to export them tompi2018-08-281-2/+4
| | | | | | userland. Inputs from markus@, ok sthen@
* Do not add ::1 on non-default lo(4) as intended.mpi2018-08-261-7/+11
| | | | Reported by and ok sthen@
* frag6_slowtimo: push NET_LOCK into frag6_freef around icmp6_error.cheloha2018-08-221-8/+6
| | | | | | | | | | | | | | | icmp6_error() still probably needs the NET_LOCK, as the call chain icmp6_error -> icmp6_reflect -> rt_match -> rt_clone -> rtrequest is possible. The fragment discard loop in frag6_slowtimo and the other cleanup bits in frag6_freef do not require it however. So push the lock down into frag6_freef around icmp6_error. Prompted by mpi. Discussed with bluhm and kn. Regress test help by bluhm. Additional testing by kn. ok kn@ visa@ mpi@
* Account when the next nd6_timer_to is scheduled in nd6_timer()florian2018-08-031-2/+4
| | | | | | | | | otherwise nd6_llinfo_settimer() might wrongly assume that a timeout is already scheduled earlier and not schedule one itself. This in turn lead to the neighbor cache no longer updating because neighbor solicitations were not send. Observed by many. OK kn
* Introduce RTM_CHGADDRATTR to inform userland on the route socket whenflorian2018-07-121-1/+9
| | | | | | | | | | an attribute of an address is changed. For now it's used when IPv6 duplicate address detection finishes. With this slaacd(8) can find out if a configured address is not duplicated without the need to poll. OK phessler, benno, claudio
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.